Correlation in Splunk Enterprise

[kenneth_wong]

Hi Guys,

I am new to Splunk Enterprise. I am currently setting up a testlab to do correlation event for a simulation attack (from Kali Linux) on an Apache Web Server (with ModSecurity installed). As I am trying to correlation two source types: one from Firewall and one from ModSecurity so that upon an attack attempt from Kali Linux(Attacker) will auto trigger an alert. I would like to understand whether it is possible to achieve this correlation event alert without Splunk Enteprise Security.

Your help is very much appreciated.

Thanks.

Regards,
Kenneth

[kenneth_wong]

Hi jpolcari

Thanks for your enlightenment. I managed to address my concern with join command where I can correlate the events from both two different data sources with same fieldname of source IP and destination port.

My search command is as follows that I would like to share:

sourcetype="sophos:utm:firewall" srcip=* dstport=80 | join srcip dstport [search sourcetype="modsec_audit"|rename SRC as srcip DPT as dstport]

Thanks.

Regards,
Kenneth

[jpolcari · Accepted solution]

This is definitely possible without ES. There are a few options for correlating data within Splunk:

-Using the transactioncommand: http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Transaction
-Using a sub search: http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchTutorial/Useasubsearch
-Using a lookup: http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Lookup

Depending on what exactly you are trying to correlate (IPs, etc), you should be able to use one of those methods to correlate between the firewall and ModSecurity.